JP2005063224A - Method and device for automatically generating security policy of secure os, and program for executing the method - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To automatically generate a security policy for operating an application on a secure OS. <P>SOLUTION: A first intermediate notation independent from implementation forms of operating system (OS) and forced access control of a target is generated from a source code or a modeling view (steps 202 and 204). In the generation of the first intermediate notation, with respect to a certain access relation, when a plurality of candidates are given for an access authority to be set in the security policy, the access authority of the candidates is presented to a user, whereby the access authority of the access relation is solved (steps 203 and 207). A second intermediate notation dependent from the directory structure of the target is generated from information for the implementation forms of OS and forced access control of the target based on the first intermediate notation (step 205), and the security policy is generated from information for the directory structure of the target based on the second intermediate notation (step 206). <P>COPYRIGHT: (C)2005,JPO&NCIPI

Description

  The present invention provides security in a secure operating system (OS: Operating System, hereinafter referred to as a secure OS) in which resource labeling and a mandatory access control (MAC) mechanism are introduced. The present invention relates to a method and an apparatus for automatically generating a security setting called a policy.

  Central government agencies that include military equipment require OSs with higher security than conventional OSs. Among secure OSs (see, for example, Non-Patent Document 1), TCSEC called a Trusted OS is particularly preferred. The spread of OSs that implement the functions required by the B1 level of (Trusted Computer Systems Evaluation Criteria) and CMWEC (Compartmented Mode Workstation Evaluation Criteria) has progressed. A secure OS refers to an OS that satisfies some of the requirements for implementing a trusted OS, such as a MAC mechanism, although implementation requirements that are not as strict as those of a trusted OS are required. Secure OSs are expected to spread further in environments that are particularly wary of information leaks, unauthorized intrusion and unauthorized use of servers by inappropriate security settings by users and superusers other than central government ministries and agencies. Yes.

  The secure OS realizes high security by finely setting a security setting called a security policy. In general, the format of this security policy is not only different depending on the OS, but also in the case where a plurality of mandatory access control implementation forms can be used in each OS, the format differs depending on the implementation form of each mandatory access control. For example, the MAC mechanism of the secure OS is based on the MAC security policy set in advance by the security administrator, no matter what setting the user or super user performs within the range of conventional discretionary access control (DAC). The process cannot operate beyond the permitted access authority. Therefore, in order to operate a certain application on the secure OS corresponding to the MAC mechanism, the process of the application is required in the security policy. Must list what processes, files, sockets, etc. resources they need to have access to.

Conventionally, this security policy has not been generated manually, but a developer who understands both the operation of the application and the specifications / security policy of the secure OS can determine the security policy for each application, OS, and implementation of mandatory access control. Needed to be generated. As described above, when the security policy corresponds to the MAC mechanism that depends on the directory structure of the target machine, the security policy must be generated in consideration of the directory structure. As described above, since a lot of information is required to generate a security policy, in order to run an application on a secure OS, a lot of costs are required at the time of development, introduction, and maintenance of the application. It will take. This is an obstacle to the spread of secure OS.
Hitachi Software Engineering Co., Ltd., Development Headquarters, “Investigation of Operating System Security Function Expansion”, IPA Security Center Survey Report, [online], published on March 11, 2002, IPA Security Center, [Confirmed July 9, 2003] Internet <URL: http://www.ipa.go.jp/security/fy13/report/secure_os/secure_os.html>

  As described above, when generating a security policy for a secure OS, the majority of them have conventionally involved human intervention, and the creator of the security policy knows both the operation of the application and the grammar of the secure OS specification / security policy. There is a need. Also, adding a security policy that is not required by the application may lead to security holes. Furthermore, setting a security policy is difficult, and is generally separate from an application developer and a developer who can understand and set the security policy. For this reason, it is expensive to use the secure OS.

  The present invention solves such a problem, and generates a security policy template from an application source file or a modeling diagram used during development when generating a security policy for using an application on a secure OS. Another object of the present invention is to provide a method and apparatus capable of automatically generating a security policy specialized for a secure OS environment using an application.

  According to the present invention, a method for automatically generating a security policy used for operating an application in a secure OS having a resource labeling and a mandatory access control mechanism is obtained from a source code representing an application or a modeling diagram. In the first intermediate notation generation stage for generating the first intermediate notation that does not depend on the OS and the implementation form of mandatory access control, and in the generation of the first intermediate notation, a certain access relationship is set in the security policy. When there are a plurality of candidates for access authority, the stage of resolving the access authority of the access relationship by presenting the candidate access authority to the user, and implementation of the target OS and forced access control based on the first intermediate notation From the form information, the target directory structure Based on the generating a second intermediate representation which is independent, a second intermediate representation comprises generating a security policy from the information in the directory structure of the target, the.

  Here, as the source code, the directive notation extension that has a syntax that is ignored by the existing compiler and does not affect the existing compiler and that has information necessary for generating the security policy is embedded in the source code. In the case of using the source code, the first intermediate notation generation step includes a step of extracting the indicator notation from the indicator notation extended source code and a step of generating the first intermediate notation from the indicator notation. You just have to prepare. In this case, the security policy description extended modeling diagram whose grammar is extended so that the information necessary for generating the security policy can be embedded is input, and this security policy description extended modeling diagram is converted into the indicator notation extended source code. May be.

  In the case of using source code according to an existing grammar as source code, the first intermediate notation generation stage extracts what resources and what access authority the process requires in the source code according to the existing grammar; Generating a first intermediate representation from the extracted access authority. In this case, a modeling diagram based on the existing grammar may be input to the modeling diagram based on the existing grammar and converted into source code based on the existing grammar.

  When the above-described security policy description extended modeling diagram is used as a modeling diagram, the first intermediate notation generation step includes a step of extracting a security policy description from the security policy description extended modeling diagram, and a first step from the security policy description. Generating an intermediate representation.

  When using a modeling diagram based on an existing grammar as a modeling diagram, the first intermediate notation generation step is a step of extracting what access authority is required for which resource by the process, and from the extracted access authority. Generating a first intermediate representation.

  According to the present invention, an apparatus for automatically generating a security policy used for operating an application in a secure OS having a resource labeling and a mandatory access control mechanism is obtained from a source code representing an application or a modeling diagram. When generating the first intermediate notation and the first intermediate notation generating means for generating the first intermediate notation that does not depend on the OS and the implementation form of the mandatory access control, a certain access relationship is set in the security policy. When there are a plurality of candidates for access authority, means for resolving the access authority of the access relationship by presenting the candidate access authority to the user, and implementation of target OS and forced access control based on the first intermediate notation From the form information, the target directory structure Generating a second intermediate representation which does not depend on, based on the second intermediate representation comprises means for generating a security policy from the information in the directory structure of the target, the.

  Here, in order to use the indicator notation extended source code as described above as the source code, the first intermediate notation generating unit extracts the indicator notation from the indicator notation extended source code, It suffices to have a means for generating one intermediate representation. In this case, there may be further provided means for converting the security policy description extended modeling diagram into the indicator notation extended source code with the above-described security policy description extended modeling diagram as an input.

  In order to use the source code based on the existing grammar as the source code, the first intermediate notation generating means extracts and extracts what access authority the process requires in the source code based on the existing grammar. It suffices to have means for generating the first intermediate notation from the access authority that has been set.

  In order to use the above-described security policy description extended modeling diagram as a modeling diagram, the first intermediate notation generation unit extracts the security policy description from the security policy description extended modeling diagram, and uses the first intermediate notation from the security policy description. What is necessary is just to provide the means to produce | generate.

  When a modeling diagram based on an existing grammar is used as a modeling diagram, the first intermediate notation generation unit extracts what access authority is required for which resource by the process, and the first access authority is extracted from the extracted access authority. It suffices to have a means for generating the intermediate representation.

  According to the present invention, it is possible to automatically generate a security policy for a secure OS, and it is possible to reduce costs during development, introduction, and maintenance management of a secure OS and an application operating on the secure OS. . Furthermore, when a security policy is automatically generated from an application source file, it is possible to prevent a security policy not required by the application from being added, thereby enhancing security.

  Next, a preferred embodiment of the present invention will be described with reference to the drawings. FIG. 1 is a block diagram showing a configuration of an automatic security policy generation apparatus according to an embodiment of the present invention.

  The automatic security policy generation apparatus 100 shown in FIG. 1 includes an application indicator notation extension source code 11, an application source code 12 based on an existing grammar, an application modeling based on an existing grammar 13, an application security policy description extended modeling diagram 14 As an input, a security policy 16 for generating the application on the secure OS is generated. Here, the indicator notation extension source code 11 refers to source code in which an indicator capable of embedding information necessary for automatic generation of a security policy is embedded. In this case, this directive has a syntax that is ignored by the existing compiler and does not affect the processing of the existing compiler. Security Policy Description Extended Modeling FIG. 14 is a modeling diagram in which the grammar is extended so that information necessary for generating a security policy can be described.

  The security policy automatic generation unit 100 includes an indicator extraction unit 111 that extracts an indicator from the indicator notation extension source code 11, a source code interpretation unit 112 that interprets a source code 12 based on an existing grammar, and security policy description extension modeling. An extension modeling diagram conversion unit 113 that converts FIG. 14 into the indicator notation extension source code 11, a modeling diagram interpretation unit 114 that interprets a modeling diagram 13 based on an existing grammar, and a security policy description extracted from the security policy description extension modeling diagram 14 A security policy description extracting unit 115, an access authority extracting unit 121 for extracting what access authority an application process requires based on an interpretation result of a source code or a modeling diagram based on an existing grammar, and an extraction The And indicator, and a security policy generating unit 131 for generating a security policy 16 based on the access rights or security policy description, the user query 141 to query the user, the.

  Specifically, the indicator extraction unit 111 extracts the indicator notation in the indicator notation extension source code 11 and converts it to the intermediate notation 1 that does not depend on the target OS and the implementation form of the mandatory access control. The source code interpreter 112 converts the source code 12 in the existing grammar into a lower language notation such as assembly language. The modeling diagram interpretation unit 114 converts the modeling diagram 13 based on the existing grammar into an intermediate notation 0 describing the process-resource relationship. The security policy description extraction unit 115 extracts the security policy description in FIG. 14 of the security policy description modeling and converts it into the intermediate notation 1 that does not depend on the target OS and the implementation form of the mandatory access control. The access authority extracting unit 121 extracts and accumulates necessary access authority from the above-described lower language notation or intermediate notation 0, and the accumulated access authority does not depend on the target OS and the implementation form of forced access control. Convert to 1. The security policy generation unit 131 converts the intermediate notation 1 into the intermediate notation 2 that does not depend on the target directory structure, and further generates a final security policy. In the target application, there may be a plurality of candidates for the access authority to be set in the security policy for a certain access relationship. For this, the user inquiry unit 141 presents the plurality of access authority candidates to the user. The security policy is set according to the access right selected by the user. That is, the indicator extracting unit 111, the security policy description extracting unit, and the access authority extracting unit 121 have a plurality of access authority candidates when the intermediate notation 1 is generated and the user inquiry unit has to be resolved. The user is inquired via 141 and the access authority is resolved.

  Next, automatic generation of a security policy by the security policy automatic generation apparatus 100 will be described. As described above, the security policy automatic generation apparatus 100 receives as input any one of the indicator notation extended source code 11, the source code 12 based on the existing grammar, the modeling diagram 13 based on the existing grammar, and the security policy description extended modeling diagram 14. The security policy is determined for each of the indicator notation extended source code 11, the existing grammar source code 12, the existing grammar modeling FIG. 13 and the security policy description extended modeling FIG. Explain how it is generated.

  When the indicator display extension source code 11 is given to the automatic security policy creation device 100, the indicator extraction unit 111 extracts the indicator from the indicator notation extension source code 11 and converts it into the intermediate notation 1, thereby generating a security policy. The unit 131 generates a security policy by converting the intermediate notation 1 based on the indicator into a security policy.

  When the source code 12 based on the existing grammar is given to the automatic security policy creation device 100, the source code interpretation unit 112 makes it possible to extract information related to the access authority necessary for automatic generation of the security policy so that the lower-level language of this source code can be extracted. Convert to. Thereafter, the access authority extraction unit 121 extracts and accumulates the access authority required by the target application based on the source code converted into the lower language, converts it into the intermediate notation 1, and generates a security policy generation unit. 131 generates the security policy 16 by converting the intermediate notation 1 based on the extracted / accumulated access authority into a security policy.

  Security Policy Description Extended Modeling There are two procedures for generating a security policy from FIG. In the first procedure, when the security policy description extended modeling FIG. 14 is given to the automatic security policy generation apparatus 100, the extended modeling diagram conversion unit 113 converts the security policy description extended modeling FIG. 14 into the indicator notation extended source code 11. Thereafter, the security policy 16 is generated by the procedure for the indicator notation extension source code 11 described above. In the second procedure, when the security policy description extended modeling FIG. 14 is given to the automatic security policy generation apparatus 100, the security policy description extraction unit 115 extracts the security policy description included in the security policy description extended modeling FIG. Then, the security policy generation unit 131 converts the intermediate description 1 based on the security policy description into a security policy, and thereby the security policy 16 generates.

  Modeling with Existing Grammar There are two procedures for generating the security policy 16 from FIG. In the first procedure, the modeling diagram conversion device 15 converts the modeling diagram 13 based on the existing grammar into the source code 12 based on the existing grammar, and the source code 12 is given to the security policy automatic generation device 100, whereby the existing grammar described above. The security policy 16 is generated according to the procedure for generating the security policy 16 from the source code 12 according to the above. As the modeling diagram conversion device 15 that generates source code from a modeling diagram, an existing technology can be used. In the second procedure, when the modeling diagram 13 of the existing grammar is given to the security policy automatic generation apparatus 100, the modeling diagram interpretation unit 114 generates what access in the target application from the modeling diagram 13. The access authority extraction unit 121 extracts and accumulates the access authority required by the target application in accordance with the extraction result of the modeling diagram interpretation unit 114, and intermediate notation based on the accumulated access authority 1 is generated. Thereafter, the security policy generation unit 131 generates the security policy 16 by converting the intermediate notation 1 based on the extracted / accumulated access authority into a security policy.

  FIG. 2 is a flowchart showing a process for automatically generating a security policy with either the security policy description extended modeling FIG. 14 or the indicator notation extended source code 11 as an input in the automatic security policy generation apparatus 100. Here, it is assumed that the security policy description extended modeling diagram is processed in the first procedure described above.

  If there is an input, it is first determined in step 201 whether the input is a security policy description extended modeling diagram or an indicator notation extended source code.

  When the input is a security policy description extended modeling diagram, the extended modeling diagram conversion unit 113 passes the security policy description extended modeling diagram. In step 211, the extended modeling diagram conversion unit 113 displays the security in the modeling diagram. The policy description is extracted, and in step 212, the security policy description is converted into an indicator notation. In parallel with these steps 211 and 212, in step 221, the extended modeling diagram conversion unit 113 extracts descriptions other than the security policy description in the modeling diagram, and in step 222, descriptions other than the security policy description are used as source code. Convert. When the conversion to the indicator notation in step 212 and the conversion to the source code in step 222 are completed, these indicator notation and source code are converted into the indicator notation extended source code including the indicator in step 223. To integrate. Thereby, the processing in the extended modeling diagram conversion unit 113 ends. Thereafter, the process proceeds to step 202.

  If the input is the indicator notation extension source code in step 201, the process proceeds to step 202 as it is.

  In step 202, the indicator extraction unit 111 extracts the indicator notation from the indicator notation extended source code. Next, in step 203, it is determined whether or not there are a plurality of access authority candidates for each setting item in the indicator notation. If there are a plurality of access authority candidates, in step 207, the user inquiry unit 141 sends them to the user. Access authority candidates are presented, and the user selects one of the access authorities. When the access authority candidates for all the setting items are determined one by one, in step 204, the indicator extraction unit 111 converts the indicator notation into an intermediate notation 1 that does not depend on the target OS and the implementation of forced access control. To do. Thereafter, in step 205, the security policy generation unit 131 converts the intermediate notation 1 into the intermediate notation 2 that does not depend on the directory structure of the target, based on the target OS and information on the implementation form of the mandatory access control. The final security policy is generated based on the directory structure information. Information regarding the target OS, the mandatory access control implementation form, and the directory structure is given as an input to the security policy generation unit 131 in advance or when generating the security policy. When a security policy is actually generated based on the present embodiment, the application is distributed together with the security policy of the intermediate notation 2 in the step 205, and directory information is collected when the application is installed on the target host. May be executed.

  FIG. 3 is a flowchart showing a process for automatically generating a security policy by using either the modeling FIG. 13 based on the existing grammar or the source code 12 based on the existing grammar in the security policy automatic generating apparatus 100. Here, it is assumed that the existing grammar is processed by the first procedure described above.

  If there is an input, it is first determined in step 301 whether the input is a modeling diagram of an existing grammar or a source code of an existing grammar. If the input is a modeling diagram of an existing grammar, in step 311, the input is given to the modeling diagram conversion device 15 to convert it into a source code of the existing grammar. Thereafter, in step 302, the source code interpretation unit 112 converts the input source code or the source code converted from the modeling diagram into a lower language notation such as an assembly language. In step 303, the access authority extraction unit 121 extracts and accumulates necessary access authority from the lower language representation. This can be realized, for example, by accumulating what kind of system call authority needs to be given by paying attention to the part where the system call is issued in the source code written in assembly language. In step 304, it is determined whether or not there are a plurality of access authority candidates for each setting item. If there are a plurality of access authority candidates, the user inquiry unit 141 presents these access authority candidates to the user in step 208. The user selects one of the access authorities. When the access authority candidates for all the setting items are determined one by one, in step 305, the access authority extraction unit 121 displays the accumulated access authority as an intermediate notation that does not depend on the target OS and the implementation form of the forced access control. Convert to 1. Thereafter, as in the case shown in FIG. 2, the security policy generation unit 131 relies on the target directory structure for the intermediate notation 1 in step 306 based on the target OS and information on the implementation form of the forced access control. In step 307, a final security policy is generated based on the directory structure information. In this case as well, the application may be distributed together with the security policy of the intermediate notation 2 at the stage of step 306, and directory information may be collected when executing the installation on the target host to execute step 307.

  FIG. 4 is a flowchart showing a process for automatically generating a security policy by applying the second procedure described above with respect to the security policy description extended modeling FIG.

  First, in step 401, the security policy description extraction unit 115 extracts a security policy description in the security policy description extended modeling diagram. Next, in step 402, it is determined whether or not there are a plurality of access authority candidates for each setting item. If there are a plurality of access authority candidates, in step 406, the user inquiry unit 141 assigns these access authority candidates to the user. Present and the user selects one of the access rights. When the access authority candidates for all the setting items are determined one by one, in step 403, the security policy description extracting unit 115 changes the security policy description to the intermediate notation 1 that does not depend on the target OS and the implementation form of the mandatory access control. Convert. Thereafter, as in the case shown in FIG. 2, the security policy generation unit 131 depends on the target directory structure for intermediate notation 1 in step 404 based on the target OS and information on the implementation form of the forced access control. In step 405, a final security policy is generated based on the directory structure information. Also in this case, the application may be distributed together with the security policy of the intermediate notation 2 at the stage of step 404, and the directory information may be collected when executing the installation on the target host to execute step 405.

  FIG. 5 is a flowchart showing a process for automatically generating a security policy by applying the second procedure described above with respect to FIG.

  First, in step 501, the modeling diagram interpretation unit 121 converts the modeling diagram into an intermediate notation 0 describing the relationship between each process and the resource. Next, in step 502, the access authority extraction unit 121 extracts the necessary access authority for each process-to-resource from the intermediate notation 0. Next, in step 503, it is determined whether or not there can be a plurality of access authority candidates for each setting item. If there are a plurality of access authority candidates, in step 507, the user inquiry unit 141 assigns these access authority candidates to the user. Present and the user selects one of the access rights. When the access authority candidates for all the setting items are determined one by one, the access authority extraction unit 121 converts the intermediate expression 0 into the intermediate expression 1 that does not depend on the target OS and the implementation form of the forced access control in step 504. To do. After that, as in the case shown in FIG. 2, the security policy generation unit 131 depends on the target directory structure for intermediate notation 1 in step 505 based on the target OS and the information on the implementation form of forced access control. In step 506, a final security policy is generated based on the directory structure information. Also in this case, the application may be distributed together with the security policy of the intermediate notation 2 in the stage of step 505, and directory information may be collected and executed in step 506 when installed on the target host.

  As described above, by using the security policy automatic generation apparatus 100 of the present embodiment, the indicator notation extension source code 11, the source code 12 based on the existing grammar, the modeling diagram 13 based on the existing grammar, and the security policy description for the application. It becomes possible to automatically generate a security policy from each of the extended modeling diagrams 14. Of course, the automatic security policy generation apparatus 100 has an indicator extraction unit 111, a source code interpretation unit 112, an extended modeling diagram conversion unit 113, a modeling diagram interpretation unit 114, depending on what is used as an input. A part of the security policy description extraction unit 115 and the access authority extraction unit 121 can be omitted. For example, if only the indicator notation extended source code is targeted, only the indicator extraction unit 111, the security policy generation unit 131, and the user inquiry unit 141 may be provided.

  Generally, the security policy automatic generation apparatus 100 described above can be realized by causing a computer such as a personal computer or a workstation to read a computer program for automatically generating a security policy and executing the program. A program for executing automatic generation of a security policy is read into a computer by a recording medium such as a CD-ROM or via a network. Such computers include, for example, a CPU, a hard disk device for storing programs and data, a main memory, an input device such as a keyboard and a mouse, a display device such as a CRT and a liquid crystal display, a CD-ROM, and the like. A reading device for reading the recording medium, and a communication interface for connecting to a network. The hard disk device, main memory, input device, display device, reading device, and communication interface are all connected to the CPU. In this computer, a recording medium storing a program for automatically generating a security policy is loaded into a reading device, the program is read from the recording medium and stored in a hard disk device, or such a program is stored via a network. The downloaded program is stored in the hard disk device, and the program stored in the hard disk device is executed by the CPU. In addition, the target application indicator notation extension source code, the existing grammar source code, the existing grammar modeling diagram, or the security policy By providing extended description modeling, automatic generation of security policies is performed.

It is a block diagram which shows the structure of the security policy automatic creation apparatus of one Embodiment of this invention. It is a flowchart which shows the process which produces | generates a security policy automatically by inputting either a security policy description extended modeling figure or indicator notation extended source code. 10 is a flowchart showing a process for automatically generating a security policy by using either a modeling diagram based on an existing grammar and a source code that follows the existing grammar as an input. It is a flowchart which shows the process which produces | generates a security policy automatically from a security policy description expansion | extension modeling figure without going through indicator notation extended source code. It is a flowchart which shows the process which produces | generates a security policy automatically from the modeling figure by an existing grammar, without going through the source code by an existing grammar.

Explanation of symbols

11 Directive extension source code 12 Existing grammar source code 13 Existing grammar modeling diagram 14 Security policy description extended modeling diagram 15 Modeling diagram converter 16 Generated security policy 100 Security policy automatic generator 111 Indicator extractor 112 Source Code interpretation unit 113 Extended modeling diagram conversion unit 114 Modeling diagram interpretation unit 115 Security policy description extraction unit 121 Access authority extraction unit 131 Security policy generation unit 141 User inquiry unit

Claims (15)

A method for automatically generating a security policy used to run an application in an operating system with resource labeling and mandatory access control mechanisms,
Generating a first intermediate representation from the source code or modeling diagram representing the application, wherein the first intermediate representation is independent of a target operating system and mandatory access control implementation;
When generating the first intermediate notation, if there are a plurality of candidates for the access authority set in the security policy for a certain access relation, the access authority for the access relation is resolved by presenting the candidate access authority to the user. And the stage of
Generating a second intermediate representation that is independent of the target directory structure from the target operating system and information on implementation of mandatory access control based on the first intermediate representation;
Generating a security policy from information on the directory structure of the target based on the second intermediate notation;
A method for automatically generating a security policy. The first intermediate representation generation stage includes:
Targeting an extension source code that has a syntax that is ignored by an existing compiler and does not affect the existing compiler, and that has a directive having information necessary for generating a security policy embedded in the source code, Extracting indicator notation from the indicator notation extension source code;
Generating the first intermediate notation from the indicator notation;
The method of automatically generating a security policy according to claim 1, comprising:   The process further includes the step of converting the security policy description extended modeling diagram into the indicator notation extended source code by using the security policy description extended modeling diagram whose grammar has been extended so that information necessary for generating the security policy can be embedded. A method for automatically generating a security policy according to claim 2. The first intermediate representation generation stage includes:
Extracting what resources and what access rights a process needs in the source code with the existing grammar for the source code with the existing grammar;
Generating the first intermediate representation from the extracted access rights;
The method of automatically generating a security policy according to claim 1, comprising:   5. The method of automatically generating a security policy according to claim 4, further comprising the step of converting a modeling diagram based on an existing grammar into a source code based on the existing grammar using a modeling diagram based on the existing grammar as an input. The first intermediate representation generation stage includes:
Extracting a security policy description extended modeling diagram from the security policy description extended modeling diagram as an input, and a security policy description extended modeling diagram whose grammar has been extended so that information necessary for generating a security policy can be embedded;
Generating the first intermediate representation from the security policy description;
The method of automatically generating a security policy according to claim 1, comprising: The first intermediate representation generation stage includes:
Using an existing grammar modeling diagram as input, extracting what resources and what access rights the process needs,
Generating the first intermediate representation from the extracted access rights;
The method of automatically generating a security policy according to claim 1, comprising: A device that automatically generates a security policy used to run an application in an operating system with resource labeling and mandatory access control mechanisms,
First intermediate notation generating means for generating a first intermediate notation independent of a target operating system and mandatory access control implementation from a source code or modeling diagram representing the application;
When generating the first intermediate notation, if there are a plurality of candidates for the access authority set in the security policy for a certain access relation, the access authority for the access relation is resolved by presenting the candidate access authority to the user. Means to
Based on the first intermediate notation, a second intermediate notation that does not depend on the directory structure of the target is generated from information on the target operating system and mandatory access control implementation, and based on the second intermediate notation, Means for generating a security policy from information on the directory structure of the target;
A device that automatically generates a security policy.   The first intermediate notation generating means embeds a directive in the source code that has a syntax that is ignored by an existing compiler and does not affect the existing compiler and that has information necessary for generating a security policy. 9. The security according to claim 8, further comprising means for extracting an indicator notation from the indicator notation extension source code and generating the first intermediate notation from the indicator notation for an indicator notation extended source code. A device that automatically generates a policy.   It further has means for converting the security policy description extended modeling diagram into the indicator notation extended source code by using the security policy description extended modeling diagram whose grammar has been extended so that information necessary for generating the security policy can be embedded. An apparatus for automatically generating the security policy according to claim 9.   The first intermediate notation generation means extracts, for the source code according to the existing grammar, what access authority is required for which resource in the source code according to the existing grammar, and the extracted access 9. The apparatus for automatically generating a security policy according to claim 8, comprising means for generating the first intermediate representation from an authority.   The first intermediate notation generating means receives as input a security policy description extended modeling diagram whose grammar is extended so that information necessary for generating a security policy can be embedded, and generates a security policy description from the security policy description extended modeling diagram. 9. The apparatus for automatically generating a security policy according to claim 8, comprising means for extracting and generating the first intermediate representation from the security policy description.   The first intermediate notation generation means receives a modeling diagram based on an existing grammar as input, extracts what kind of access authority a process requires, and extracts the first intermediate expression from the extracted access authority 9. The apparatus for automatically generating a security policy according to claim 8, comprising means for generating a notation. To automatically generate a security policy that is used to run applications in an operating system with resource labeling and mandatory access control mechanisms,
Processing to generate a first intermediate representation independent of the target operating system and mandatory access control implementation from the source code or modeling diagram representing the application;
When generating the first intermediate notation, if there are a plurality of candidates for the access authority set in the security policy for a certain access relation, the access authority for the access relation is resolved by presenting the candidate access authority to the user. Processing to
Based on the first intermediate notation, generating a second intermediate notation independent of the target directory structure from information on the target operating system and mandatory access control implementation;
A process of generating a security policy from information on the directory structure of the target based on the second intermediate notation;
A program that executes A computer-readable recording medium that stores the program according to claim 14.

Images